feat: 部署 sandbox SPIRE Agent 与 CSI

clusters/sandbox/README.md

@@ -36,6 +36,16 @@ SPIFFE CR status/finalizer 和 leader election。它不复用只允许 TokenRevi
 reviewer。Ansible 将两份 kubeconfig 写入同一个 central Secret 的不同 key，便于 central
 chart 分别绑定 `sandbox` 与 `sandbox-controller`。
 
+Central SPIRE Server 通过内网 `spire-server.ad.ddupan.top:8081` 接收 sandbox Agent
+attestation。Server 使用 external bundle publisher 持续维护 sandbox
+`spire-system/spire-bundle`，Agent 不固定或复制 trust bundle。Sandbox HelmRelease
+显式关闭 Server 与 OIDC Provider，只部署 Agent DaemonSet 和 SPIFFE CSI Driver；因此
+不会产生第二个 trust root。
+
+`spire-smoke` namespace、ServiceAccount 和 `sandbox-spire-smoke` ClusterSPIFFEID 是
+普通 Pod 与后续 Kata guest 的回归夹具，稳定身份为
+`spiffe://ddupan.top/sandbox/smoke`。测试 Pod 临时创建并在验收后删除，身份声明保留。
+
 ## 监控边界
 
 这里只管理 sandbox LXC 内的 Kubernetes 监控，不负责 PVE 宿主监控。LXC 与宿主共享

clusters/sandbox/apps/spire-agents.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: spire-agents
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: spire-bootstrap
+    - name: monitoring-operator
+  interval: 10m
+  path: ./platform/sandbox-spire/agents
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 15m
+  wait: true

clusters/sandbox/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - apps/monitoring-operator.yaml
   - apps/monitoring.yaml
   - apps/spire-bootstrap.yaml
+  - apps/spire-agents.yaml

infrastructure/dns/records.yml

@@ -20,6 +20,7 @@ homelab_dns:
       - { zone: ad.ddupan.top, name: nats, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: s3, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: spire-oidc, type: A, values: [192.168.10.127] }
+      - { zone: ad.ddupan.top, name: spire-server, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: zot, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: zot-push, type: A, values: [192.168.10.127] }
 

platform/sandbox-monitoring/README.md

@@ -4,7 +4,8 @@
 
 - kubelet 与 cAdvisor；
 - kube-state-metrics；
-- vmagent 自身运行状态。
+- vmagent 自身运行状态；
+- SPIRE Agent attestation、SVID 与连接状态。
 
 不得在 sandbox LXC 内部署 node_exporter。LXC 的 `/proc/stat` 暴露 PVE 宿主 CPU
 视图，会产生重复且语义混合的指标。PVE 宿主监控不属于本目录。

platform/sandbox-monitoring/workloads/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - kubelet-scrapes.yaml
   - kube-state-metrics.yaml
   - kube-state-metrics-scrape.yaml
+  - spire-agent-scrape.yaml

platform/sandbox-monitoring/workloads/spire-agent-scrape.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: spire-agent
+  namespace: monitoring
+spec:
+  namespaceSelector:
+    matchNames:
+      - spire-system
+  podMetricsEndpoints:
+    - interval: 30s
+      port: prom
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: sandbox-spire
+      app.kubernetes.io/name: agent

platform/sandbox-spire/agents/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - values.yaml
+  - release.yaml
+  - smoke-identity.yaml

platform/sandbox-spire/agents/release.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sandbox-spire
+  namespace: spire-mgmt
+spec:
+  chart:
+    spec:
+      chart: spire
+      interval: 1h
+      sourceRef:
+        kind: HelmRepository
+        name: spiffe-hardened
+      version: 0.30.2
+  dependsOn:
+    - name: spire-crds
+      namespace: spire-mgmt
+  driftDetection:
+    mode: enabled
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  interval: 30m
+  releaseName: sandbox-spire
+  targetNamespace: spire-mgmt
+  timeout: 15m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  valuesFrom:
+    - kind: ConfigMap
+      name: sandbox-spire-values

platform/sandbox-spire/agents/smoke-identity.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: spire-smoke
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: spire-smoke
+  namespace: spire-smoke
+---
+apiVersion: spire.spiffe.io/v1alpha1
+kind: ClusterSPIFFEID
+metadata:
+  name: sandbox-spire-smoke
+spec:
+  className: spire-mgmt-spire
+  namespaceSelector:
+    matchLabels:
+      kubernetes.io/metadata.name: spire-smoke
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: spire-smoke
+  spiffeIDTemplate: spiffe://{{ .TrustDomain }}/sandbox/smoke
+  workloadSelectorTemplates:
+    - k8s:ns:spire-smoke
+    - k8s:sa:spire-smoke

platform/sandbox-spire/agents/values.yaml

@@ -0,0 +1,86 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sandbox-spire-values
+  namespace: spire-mgmt
+data:
+  values.yaml: |
+    global:
+      k8s:
+        clusterDomain: cluster.local
+      spire:
+        bundleConfigMap: spire-bundle
+        clusterName: sandbox
+        trustDomain: ddupan.top
+        namespaces:
+          create: false
+          system:
+            name: spire-system
+          server:
+            name: spire-server
+        recommendations:
+          enabled: true
+          namespaceLayout: true
+          namespacePSS: true
+          priorityClassName: true
+          strictMode: true
+          securityContexts: true
+          prometheus: false
+
+    spire-server:
+      enabled: false
+
+    spire-agent:
+      enabled: true
+      serviceAccount:
+        name: spire-agent
+      server:
+        address: spire-server.ad.ddupan.top
+        port: 8081
+      nodeAttestor:
+        k8sPSAT:
+          enabled: true
+      workloadAttestors:
+        k8s:
+          enabled: true
+        unix:
+          enabled: false
+      telemetry:
+        prometheus:
+          enabled: true
+          podMonitor:
+            enabled: false
+      resources:
+        requests:
+          cpu: 25m
+          memory: 64Mi
+        limits:
+          cpu: 250m
+          memory: 192Mi
+
+    spiffe-csi-driver:
+      enabled: true
+      resources:
+        requests:
+          cpu: 10m
+          memory: 32Mi
+        limits:
+          cpu: 100m
+          memory: 96Mi
+
+    spiffe-oidc-discovery-provider:
+      enabled: false
+
+    upstream:
+      enabled: false
+    tornjak-frontend:
+      enabled: false
+    spire-identity-exchange:
+      enabled: false
+    spike-keeper:
+      enabled: false
+    spike-nexus:
+      enabled: false
+    spike-pilot:
+      enabled: false

platform/sandbox-spire/bootstrap/controller-manager.yaml

@@ -78,6 +78,39 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
+metadata:
+  name: spire-bundle-publisher
+  namespace: spire-system
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: spire-bundle-publisher
+  namespace: spire-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: spire-bundle-publisher
+subjects:
+  - kind: ServiceAccount
+    name: spire-controller-manager
+    namespace: spire-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
 metadata:
   name: spire-controller-manager-leader-election
   namespace: spire-server

platform/spire/README.md

@@ -19,6 +19,11 @@ Flux 安装 SPIFFE hardened charts：
 API 或 Broker API。Trust domain 是 `ddupan.top`，Kubernetes cluster name 是
 `homelab`。
 
+同一 Server 也接受 cluster name 为 `sandbox` 的 external PSAT attestation。SPIRE gRPC
+只通过内网 `spire-server.ad.ddupan.top:8081` 暴露；external PSAT、external
+controller-manager 与 bundle publisher 使用由 sandbox Ansible bootstrap 的独立、受限
+kubeconfig。Sandbox 不运行第二套 Server 或 OIDC Provider。
+
 ## PostgreSQL bootstrap
 
 SPIRE registration datastore 使用共享 CloudNativePG：

platform/spire/values.yaml

@@ -30,6 +30,42 @@ spire-server:
   kind: statefulset
   replicaCount: 1
   auditLogEnabled: true
+  service:
+    type: LoadBalancer
+    port: 8081
+    loadBalancerIP: 192.168.10.127
+  kubeConfigs:
+    sandbox:
+      externalSecret:
+        name: spire-external-kubeconfigs
+        key: sandbox
+    sandbox-controller:
+      externalSecret:
+        name: spire-external-kubeconfigs
+        key: sandbox-controller
+  nodeAttestor:
+    externalK8sPSAT:
+      enabled: true
+      clusters:
+        sandbox:
+          kubeConfigName: sandbox
+          serviceAccountAllowList:
+            - spire-system:spire-agent
+  externalControllerManagers:
+    enabled: true
+    clusters:
+      sandbox:
+        kubeConfigName: sandbox-controller
+  bundlePublisher:
+    externalK8sConfigMap:
+      enabled: true
+      clusters:
+        sandbox:
+          kubeConfigName: sandbox-controller
+          namespace: spire-system
+          configMapName: spire-bundle
+          configMapKey: bundle.spiffe
+          format: spiffe
   persistence:
     # PostgreSQL stores registrations, but the disk KeyManager still needs durable
     # storage for the trust-domain signing keys.